> For the complete documentation index, see [llms.txt](https://www.xn--hy1b43d247a.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.xn--hy1b43d247a.com/real-attack-ttp-and-mitigations/concepts.md).

# 개념

### 공격자 정보

공격자 도메인: koreambtihealth.com

### 타겟 정보

* 타겟 내부망 도메인: choi.local
* 타겟 피해자 유저: <h.park@choi.local>

### TTP 정보

1. 초기 침투
   1. 피싱 이메일 + HTML 스머글링
   2. 피해자 유저가 사내 내부망에서 자신의 개인 이메일 확인 -> 스머글링에 걸림
   3. VBS Purged maldoc OR remote template injection maldoc OR DotNetToJscript (.js) file. If using maldocs, potentially use .zip protected? Or go for XSL + DotNetToJscript for executing xsl + Jscript
      1. Embedded C# stager should use direct syscall (modified dinvoke) + AMSI/ETW bypass + ppid spoofing + process injection to inject shellcode into a remote process
   4. Nope, using iso payload + lnk + dll sideloading (and hidden attributes) + sliver or Covenant.
   5. Local enumeration + Domain enumeration
   6. Kerberoasting service acocunt + Cracking
   7. Gaining the service account with kerberoasting + accessing another workstation -> dumping LSASS using handlekatz from powershell + AMSI bypass
   8. DA creds and yay!